After years of not really pushing cookie compliance, it seems the ICO has really got the cookie chip between its teeth of late.
As well as evidence of enforcement (see https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/09/action-taken-against-sky-betting-and-gaming-for-using-cookies-without-consent/) in the ICO’s most recent statement about their plans for cookies in 2025 they set out their plans:
- To review cookie usage by the biggest UK sites, with plans to bring the UK’s top 1000 websites into compliance
- For their 2025 online tracking strategy
- Their thoughts on “consent or pay” models, where visitors are given a choice about accepting the website’s preferred cookies, or pay to have a choice
Online Tracking Strategy for 2025
The strategy sets out their achievements in 2024 which include:
- Updated cookie guidance (currently in draft pending consultation feedback): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/
- Continued review of the top UK websites
- The consultation on “consent or pay”
- Working with Meta on more privacy friendly ad measurement techniques
For 2025, the plan is to focus on online advertising. They say they “want to see fair and consistent” approaches where individuals “have meaningful control over how personal information is used“. However, they recognise the “first mover disadvantage” situation where some businesses may be reticent to change their approaches unless their competitors do to, and it is this they plan on focusing their efforts.
They have identified four areas where individuals are not being given the control they should:
- Deceptive or absent choice – i.e. the inability to opt-out of non-essential processing, or cookies being set regarding of choice
- Uninformed choice – where individuals can’t make an informed decision about consent to cookies and tracking, as not enough information is provided
- Undermined choice – where organisations set out how they will process personal data, but don’t actually deliver on their promises
- Irrevocable choice – where individuals can’t change their minds once they’ve interacted with cookie banners (for example)
For more information see: https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/online-tracking-strategy/
Consent or pay
The ICO have now published their views on “consent or pay” models for handling advertising cookies. You’ll no doubt have seen websites offering you the ability to opt-out of marketing cookies by paying a fee – this is what their views address.
In the guidance (see https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-tracking/consent-or-pay/) the ICO say “consent or pay” models can be compliant if they follow the rules for consent and PECR. Specifically:
- Website visitors must be able to freely give consent and there is no power imbalance
- The level of fee should be appropriate – if the fee is too high, an individual may feel they have no choice but to consent
- Consent or pay should offer broadly the same core product/service
As always, get in touch if you need further guidance on the impact these cookie plans may have on your business or organisation.
